Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redirect for the Github Authorization should use HTTPS rather than HTTP in production #260

Open
goneall opened this issue Nov 20, 2020 · 2 comments
Labels

Comments

@goneall
Copy link
Member

goneall commented Nov 20, 2020

I'm not sure if this is a security vulnerability, but the redirect probably should use HTTP rather than HTTPS.

Just changing it to HTTPS will likely mess up those running the spdx-online-tools in test environments or local development environments.

Perhaps the System configuration debug could be checked and the appropriate redirect made.

NOTE: the Github Auth configurations need to be updated to HTTPS as well as the code once this goes into production.

@rtgdk
Copy link
Collaborator

rtgdk commented Nov 23, 2020

@goneall Which code needs to be updated? I think only Github configuration needs to be changed.

@goneall
Copy link
Member Author

goneall commented Nov 23, 2020

@rtgdk I'm not sure where the code is that needs to be updated, but there is a call to the Github API's where a URL is passed as a parameter for the authentication callback. That code should be changed from http:// to https://

@rtgdk rtgdk added gsoc good-first-issue Begineer issue labels Mar 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants